Threat database

Two former United States Air Force members were sentenced to a combined 189 months in federal prison for their involvement in a multi-year campaign of business email compromise (BEC) scams and phishing attacks. These attacks targeted organizations to fraudulently obtain funds or sensitive information through deceptive emails.

A vulnerability in the Joi validation library's isoDate string validation allows an attacker to cause a denial of service by sending a specially crafted string. The issue arises from a quadratic regular-expression backtracking problem that causes the validation to stall for a time proportional to the square of the input length. This can lead to significant application delays or stalls. Fixed versions are available in Joi 17.13.7 and 18.2.6.

A local race condition vulnerability exists in the Squirrel.Mac auto-update framework bundled with Electron on macOS. The privileged ShipIt helper, which runs as root to complete updates, can be tricked by a local attacker to overwrite files of a different application instead of the intended one. This affects only Electron apps on macOS that use Squirrel.Mac-based auto-updates. No workarounds exist other than updating to a patched Electron version.

This content discusses the limitations of using CVSS scores alone for vulnerability prioritization and proposes a five-signal framework that better aligns with actual exploitation likelihood. It emphasizes that CVSS measures potential severity but not the probability of exploitation. The framework incorporates signals such as confirmed exploitation (KEV), predicted exploitation (EPSS), asset criticality, compensating controls, and exposure to prioritize vulnerabilities more effectively.

Electron versions prior to 41.10.4, between 42.0.0-alpha.1 and 42.5.2, and between 43.0.0-alpha.1 and 43.0.0 allowed popups opened from sandboxed iframes with 'allow-scripts allow-popups' to drop sandbox restrictions. This enabled sandboxed content to open popups with the embedding app's full origin, potentially accessing cookies, storage, and same-origin scripting. The issue affects apps embedding untrusted content in sandboxed iframes with these permissions. Fixed versions are 41.10.4, 42.5.2, and 43.0.0.

Electron versions prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5 contain a vulnerability where windows opened from a sandboxed top-level document do not inherit the document's HTML sandbox restrictions. This allows sandboxed content to open new windows with the app's full origin, potentially escalating privileges. The issue affects apps rendering untrusted content in sandboxed top-level documents that allow popups. Apps that deny popups from untrusted content using setWindowOpenHandler are not affected. Fixes are available in the specified versions.

Electron versions prior to 41.10.6, between 42.0.0-alpha.1 and 42.9.2, between 43.0.0-alpha.1 and 43.4.1, and between 44.0.0-alpha.1 and 44.0.0-beta.5 have a vulnerability where file and HTTP protocol handlers allow cross-origin reads without the corsEnabled flag. This affects apps that register custom schemes with supportFetchAPI enabled but corsEnabled disabled and load untrusted content. The vulnerability allows cross-origin reading of responses, completing a previous fix (CVE-2026-70604). Fixed versions include 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5. Setting corsEnabled to true or avoiding loading untrusted content mitigates the issue.

A vulnerability in Electron's <webview> tag allows Node.js integration to be enabled in Web Workers even when the embedder disables it, potentially granting guest content elevated privileges. This affects applications that enable the <webview> tag and run without sandboxing. The issue is fixed in Electron versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5. Workarounds include removing nodeIntegrationInWorker from guest preferences or avoiding <webview> usage with untrusted content.

A vulnerability in Electron's sandboxed preload script caching allows a compromised renderer process to poison the cache and execute arbitrary code in the preload context on subsequent loads. This affects applications that load untrusted content. Fixed versions have been released, and updating is required as no application-side workarounds exist.

CVE-2026-84414 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It allows a local authenticated attacker to change ownership of arbitrary files due to improper validation of file paths. This incorrect permission assignment could lead to full confidentiality, integrity, and availability compromise of affected systems.

Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`. (The affected metadata-parser header states "Some portions generated by Copilot (Sonnet 4.6)" — an AI-generated parser with an unchecked on-flash count.)

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes whatever follows as a theme header, and writes a `GX_THEME` and its tables into that zero-byte buffer.

markdown-it versions prior to 15.0.1 and before 14.3.1 have two independent quadratic time complexity paths when the linkify option is enabled. This causes the event loop to be blocked for tens of seconds when processing a few hundred KB of markdown containing many linkifiable tokens, leading to availability degradation. The issue arises from inefficient array rebuilding and repeated regex matching in markdown-it's own code, not in the linkify-it dependency. The vulnerability affects only applications that enable the linkify option, which is off by default.

A vulnerability in js-yaml versions 5.0.0 up to but not including 5.4.1 allows an attacker to cause excessive CPU consumption by exploiting how empty merge source mappings are counted. The maxTotalMergeKeys setting does not count empty mappings, enabling an attacker to craft YAML documents that cause the loader to perform O(N*K) work, leading to prolonged CPU usage. This can result in denial of service due to resource exhaustion. A patch is available that adjusts the counting method to include every merge source mapping as one budget unit.

FTP Passive Data Connection Not Bound to the Authenticated Control Peer

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction.

IBM Guardium Data Protection version 12.2 contains a command injection vulnerability in the CLI certificate SMIME recipient deletion functionality. This flaw allows an authenticated privileged CLI user to execute arbitrary OS commands with root privileges. The vulnerability has a high severity score and impacts confidentiality, integrity, and availability of the system.

CVE-2026-102728 is a high-severity buffer over-read vulnerability in the Eclipse Foundation's NetX Duo library. It affects two client-side TLS/DTLS handshake parsers that read server-supplied message fields before verifying the message length, leading to out-of-bounds reads. This flaw occurs when a TLS or DTLS client connects to a malicious or malformed server. The vulnerability has a CVSS score of 7.5, indicating significant confidentiality impact but no integrity or availability impact. Affected versions include all NetX Duo releases up to and including 6.5.1.202602.

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged authenticated CLI user to execute arbitrary commands with root privileges.

Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read